Detecting anomalies using real-time controller processing activity

Abstract

Disclosed embodiments relate to identifying Electronic Control Unit (ECU) anomalies in a vehicle. Operations may include monitoring data representing real-time processing activity of the ECU; receiving comparable data relating to processing activity of at least one other ECU deemed comparable in functionality to the ECU; comparing the real-time processing activity data with the comparable data, to identify at least one anomaly in the real-time processing activity of the ECU; and implementing a control action for the ECU when the at least one anomaly is identified.

What is claimed is: 
     
       1. A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for identifying controller anomalies, comprising:
 monitoring data representing real-time processing activity of a controller; 
 receiving comparable data relating to processing activity of at least one other controller deemed comparable in functionality to the controller; 
 comparing the real-time processing activity data with the comparable data, to identify, based on a deviation between the real-time processing activity data and the comparable data, at least one anomaly in the real-time processing activity of the controller; and 
 implementing a control action for the controller when the at least one anomaly is identified based on the deviation; wherein:
 software on the controller is mapped to a plurality of functional units, and the controller is configured to utilize a virtual file system (VFS) to manage and track one or more versions of each of the plurality of functional units, and 
 the control action includes updating memory addresses of one or more functional units managed by the VFS based on a delta file corresponding to a second version of the software on the controller, wherein the delta file comprises position-independent code and startup code for updating the memory addresses. 
 
 
     
     
       2. The non-transitory computer readable medium of  claim 1 , wherein the control action includes issuing a prompt to adjust the controller from executing a first version of the software on the controller to the second version of the software on the controller. 
     
     
       3. The non-transitory computer readable medium of  claim 1 , wherein the comparing uses a machine learning technique to identify the at least one anomaly in the real-time processing activity of the controller. 
     
     
       4. The non-transitory computer readable medium of  claim 1 , wherein the comparable data comprises a model or map of controller functions. 
     
     
       5. The non-transitory computer readable medium of  claim 1 , wherein the comparable data comprises data obtained in real-time relating to processing activity of a plurality of other controllers deemed comparable to the controller. 
     
     
       6. The non-transitory computer readable medium of  claim 1 , wherein the comparable data comprises data previously gathered relating to processing activity of a plurality of other controllers deemed comparable to the controller. 
     
     
       7. The non-transitory computer readable medium of  claim 1 , wherein receiving the comparable data further comprises:
 obtaining the comparable data based on rules associated with controller software running on the controller. 
 
     
     
       8. The non-transitory computer readable medium of  claim 1 , wherein receiving the comparable data further comprises:
 obtaining the comparable data based on known valid sequences of execution of the software on the controller. 
 
     
     
       9. The non-transitory computer readable medium of  claim 1 , wherein receiving the comparable data further comprises:
 obtaining the comparable data based on known potentially malicious sequences of execution of the software on the controller. 
 
     
     
       10. The non-transitory computer readable medium of  claim 1 , wherein receiving the comparable data further comprises:
 obtaining the comparable data based on a map file associated with the software on the controller. 
 
     
     
       11. The non-transitory computer readable medium of  claim 1 , wherein the controller is associated with a device, and wherein receiving the comparable data further comprises:
 receiving observational data from other devices; and 
 obtaining the comparable data based on the observational data. 
 
     
     
       12. The non-transitory computer readable medium of  claim 1 , wherein the at least one anomaly corresponds to specific memory locations used by the controller. 
     
     
       13. The non-transitory computer readable medium of  claim 1 , wherein the at least one anomaly corresponds to specific sequences of memory locations used by the controller. 
     
     
       14. The non-transitory computer readable medium of  claim 1 , wherein the at least one anomaly corresponds to at least one peak in data flow in or out of the controller. 
     
     
       15. The non-transitory computer readable medium of  claim 1 , wherein the at least one anomaly corresponds to at least one peak in data processing by a processor of the controller. 
     
     
       16. The non-transitory computer readable medium of  claim 1 , wherein the at least one anomaly corresponds to at least one anomaly in power consumption of the controller. 
     
     
       17. The non-transitory computer readable medium of  claim 1 , wherein the control action comprises at least one of:
 sending an alert associated with the controller, 
 blocking an instruction sent from the controller, or 
 rolling back a version of the software on the controller to a prior version of software. 
 
     
     
       18. A system for identifying controller anomalies, the system comprising:
 one or more processors; and 
 one or more memories having instructions that, when executed by the one or more processors, cause the one or more processors to perform the operations of:
 monitoring data representing real-time processing activity of the controller; 
 receiving comparable data relating to processing activity of at least one other controller deemed comparable in functionality to the controller; 
 comparing the real-time processing activity data with the comparable data, to identify, based on a deviation between the real-time processing activity data and the comparable data, at least one anomaly in the real-time processing activity of the controller; and 
 implementing a control action for the controller when the at least one anomaly is identified based on the deviation; wherein:
 software on the controller is mapped to a plurality of functional units, and the controller is configured to utilize a virtual file system (VFS) to manage and track one or more versions of each of the plurality of functional units, and 
 the control action includes updating memory addresses of one or more functional units managed by the VFS based on a delta file corresponding to a second version of the software on the controller, wherein the delta file comprises position-independent code and startup code for updating the memory addresses. 
 
 
 
     
     
       19. The system of  claim 18 , wherein the control action comprises issuing a prompt to adjust the controller from executing a first version of the software on the controller to the second version of the software on the controller. 
     
     
       20. A computer-implemented method for identifying controller anomalies, the method comprising:
 monitoring data representing real-time processing activity of a controller; 
 receiving comparable data relating to processing activity of at least one other controller deemed comparable in functionality to the controller; 
 comparing the real-time processing activity data with the comparable data, to identify, based on a deviation between the real-time processing activity data and the comparable data, at least one anomaly in the real-time processing activity of the controller; and 
 implementing a control action for the controller when the at least one anomaly is identified based on the deviation; wherein:
 software on the controller is mapped to a plurality of functional units, and the controller is configured to utilize a virtual file system (VFS) to manage and track one or more versions of each of the plurality of functional units, and 
 the control action includes updating memory addresses of one or more functional units managed by the VFS based on a delta file corresponding to a second version of the software on the controller, wherein the delta file comprises position-independent code and startup code for updating the memory addresses.